Between March and August 2026, malicious detections involving the open-source tool GSocket surged 356.2% on Linux servers, according to Microsoft Security Blog Defender for Endpoint telemetry reported by BleepingComputer.
Threat actors deploy GSocket to maintain persistent access after initial web application vulnerabilities are patched noted by the Microsoft Security Blog. The tool routes traffic through the Global Socket Relay Network, bypassing traditional inbound firewall restrictions and network address translation.
The compromised host and the operator both connect outbound to the relay, which bridges the two sessions.
Microsoft
“The host needs no inbound listener or public IP address, and network address translation does not prevent the connection.” Microsoft explained.
Web applications and hosting environments accounted for 87.1% of all observed incidents reported by BleepingComputer. PHP web applications and cPanel hosting represent 63.9% of the total, while Apache environments account for 24.3%.
Attackers disguise GSocket process names as kernel threads observed by Microsoft. Persistence is maintained through cron jobs, systemd services, and shell startup files.
In certain attacks, operators attempted to exploit the “Dirty Frag” Linux kernel flaw, tracked as CVE-2026-43284, to secure root privileges on compromised hosts reported by BleepingComputer.
“In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host,” Canonical, Ubuntu's parent company, warns.
Multiple threat actors abused GSocket across the observed intrusions, transforming initial web application compromises into long-term intrusions that outlasted the original remediation efforts. By utilizing shared secrets rather than fixed IP addresses or hostnames to identify endpoints during deployment, the tool prevents defenders from easily disrupting connections using standard IP- or domain-based access control lists.
During the installation phase, threat actors frequently used curl commands to fetch remote scripts and download payloads from GSocket distribution endpoints into directories like /dev/shm/.gs-0. The deployment scripts typically generate a random secret that can be written to standard output, redirected to temporary files before deletion, or transmitted directly via notification channels such as Discord, Telegram using specific tokens and chat IDs, or webhooks.
Security researchers recommend that administrators thoroughly audit their environments by inspecting cron entries, checking systemd units for plausible service names, and reviewing shell startup files.